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Introduction 


1. The Freedom of Information Act 2000 (FOIA) gives rights of 
public access to information held by public authorities. 


2. An overview of the main provisions of FOIA can be found in The 
Guide to Freedom of Information. 


3. This is part of a series of guidance, which goes into more detail 
than the Guide, to help public authorities to fully understand 
their obligations and promote good practice. 
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4. This guidance explains to public authorities the main provisions 
of section 33, which relates to information on audit functions, 
and how to apply the exemption. 


Overview 


e Section 33 provides an exemption for information on public audit 
functions. 


e It applies to public authorities that carry out audits or audit-type 
inspections of other public authorities. 


e The exemption is engaged in respect of information whose 
disclosure would or would be likely to prejudice the authority’s 
audit functions, and where the balance of the public interest 
favours the maintenance of the exemption. 


e The duty to confirm or deny does not apply where confirming or 
denying that information is held would or would be likely to 
prejudice audit functions. 


What FOIA says 


5. Section 33 states: 


33.-(1) This section applies to any public authority which has 
functions in relation to— 


(a) the audit of the accounts of other public authorities, or 


(b) the examination of the economy, efficiency and 
effectiveness with which other public authorities use 
their resources in discharging their functions. 


(2) Information held by a public authority to which this 
section applies is exempt information if its disclosure would, or 
would be likely to, prejudice the exercise of any of the 
authority’s functions in relation to any of the matters referred 
to in subsection (1). 


(3) The duty to confirm or deny does not arise in relation to a 
public authority to which this section applies if, or to the 
extent that, compliance with section 1(1)(a) would, or would 
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be likely to, prejudice the exercise of any of the authority’s 
functions in relation to any of the matters referred to in 
subsection (1). 


Authorities and the section 33 exemption 


Who can claim the exemption? 


6. Section 33 only applies to those public authorities that have 
public audit and other inspection functions specified in section 
33(1), in relation to other public authorities. Such functions 
may have been granted by statute or informally. 


7. The definition includes public audit bodies such as: 


The National Audit Office; 

The Audit Commission for Local Authorities and the 
National Health Service in England (closure of the Audit 
COON is planned for 2015; please see 


local- ~audit/): and 
The Northern Ireland Audit Office. 


8. It also includes other bodies whose “functions” include the 
“examination of the economy, efficiency and effectiveness with 
which other public authorities use their resources” in section 
33(1), such as: 


Ofsted; 

The Education and Training Inspectorate; 

Estyn; 

HM Inspectorate of Constabulary; 

HM Inspectorate of Prisons; 

The Care Quality Commission; and 

The Office of Government Commerce (OGC) (now part of 
the Efficiency and Reform Group within the Cabinet 
Office). 


9. When considering the application of the exemption, it is 
important first to establish whether the authority in question 
“has audit functions” as specified in section 33(1). FOIA does 
not require these to be statutory functions. 
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10. 


11. 


Section 33(1)(a) relates to financial audits of public authorities, 
with the aim of ensuring sound financial management and the 
proper use of public money. 


Section 33(1)(b) concerns the way public authorities use their 
resources when carrying out their functions, examining 
“economy, efficiency and effectiveness”. This expression is not 
further defined, but will encompass information about 
inspections of the use of resources such as staff and premises, 
as well as the standard of services provided by the authority 
being audited. 


Example 


In FS50070196 the complainants had requested information 
on the traffic light status of Gateway Reviews carried out by 
the Office for Government Commerce (OGC) in relation to 
plans to introduce ID cards; the requests were refused under 
sections 33 and 35. 


The Commissioner considered whether section 33 applied to 
the information: “Gateway reviews take place at key decision 
points in major acquisition programmes and procurement 
projects in civil central government. The OGC has explained 
that one of its functions is to examine and review the ID card 
programme, at critical stages in its lifecycle, to assess whether 
it can progress successfully and to make the necessary 
recommendations in order for it to do so. The Commissioner is 
therefore satisfied the OGC does examine the economy, 
efficiency and effectiveness with which other public authorities 
use their resources in discharging their functions. Therefore 
the Commissioner is satisfied that OGC is a public authority to 
which the exemption at s.33 of the Act applies”. 


The Commissioner’s view was that all stages of Gateway 
Reviews are audit functions for the purposes of section 33. 


Example 


In decision notice FS50123184 the Commissioner considered 
arguments put forward by Ofsted in support of the application 
of s33. In particular, Ofsted explained how its functions met 
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the definition in s33(1)(b). 


He concluded: “through the school inspection process the 
public authority does have functions relating to “economy, 
efficiency and effectiveness” with which other public 
authorities use their resources and the Commissioner accepts 
that the public authority has functions relevant to section 
33(1)(b) and can, therefore, cite this exemption....... 

The withheld information was recorded in the course of a 
school inspection and the Commissioner further accepts that 
this information was generated in the course of the public 
authority carrying out the functions described in section 
33(1)(b).” 


When can’t the exemption apply? 


12. The following are examples of situations in which the 


exemption cannot apply: 


Internal audit functions carried out by public authorities; it 
only applies to audit or audit-type functions in respect of 
other public authorities. 


Public authorities that are the subject of an audit cannot claim 
the exemption in s33; for example in respect of papers or 
correspondence they hold about their audit. Other exemptions 
may be available to them instead. 


What the exemption is designed to protect 


Information protected by the exemption 


13. Section 33 exempts information if its disclosure “would, or 


14. 


would be likely to, prejudice the exercise of any of the 
authority’s functions”; those functions are specified in 
$33(1)(a) and (b). 


These might include not only functions such as annual audit 
and value for money studies, but also the appointment of 
auditors under the Audit Commission Act. 
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15. 


16. 


Examples of the types of information which may be covered by 
the exemption include: 


draft reports; 
audit methodologies; 


correspondence between auditors and bodies subject to 
audit; and 


information provided to auditors by whistleblowers or other 
informants. 


Clearly information which has been placed in the public 
domain, for instance published audit reports, will not be 
covered by the exemption. 


Would or would be likely to prejudice 


17. 


18. 


19. 


20. 


The exemption is prejudice-based. It only applies if disclosure 
of the requested information “would, or would be likely to, 
prejudice the exercise of any of the authority’s functions in 
relation to any of the matters referred to in subsection (1)”. 
This could potentially cover any information the auditing 
authority holds. 


The term “would... prejudice” means that it is more likely than 
not to occur (ie a more than 50% chance) that prejudice would 
occur. “Would be likely to prejudice” is a lower threshold; this 
means that even if there is below a 50% chance, there must be 
a real and significant likelihood of prejudice occurring. The 
likelihood of prejudice arising must be decided on the facts of 
each case. 


For more details on this, please see our guidance the prejudice 
test. 


The assessment of prejudice is relevant to the public interest 
test. Note that the choice between “would” and “would be likely” 
is important because it affects the balance of factors in the public 
interest test. The greater the likely prejudice to the public audit 
function, the stronger the public interest in not disclosing the 
information requested. Please see arguments in favour of 
maintenance of the exemption at paragraph 26 in this guidance. 
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Nature of the prejudice 


21. The types of prejudice that may arise from disclosure are those 


22. 


23. 


relating to “the exercise of the authority’s functions” as set out 
in section 33(1): 


(a) the audit of the accounts of other public authorities, or 


(b) the examination of the economy, efficiency and 
effectiveness with which other public authorities use their 
resources in discharging their functions. 


This would include, for instance, prejudice to a specific audit 
which is taking place, or to processes such as the appointment 
of auditors. 


The timing of the request is also relevant. The early release of 
an audit report, either before the auditing exercise has been 
completed or even where the report is still at draft stage, might 
cause prejudice to that particular audit. For instance, this could 
provide a premature indication of the findings in the report 
before they have been checked or agreed, affecting the 
behaviour of the organisation being audited. On the other 
hand, once an audit has been completed and the final report 
published, it would be hard to argue that prejudice would be 
caused by disclosure. 


It could also include more general prejudice to audit functions. 
For instance, numerous standard audit methodologies are in 
the public domain, and it would be difficult to argue that 
disclosure of such information would prejudice audit functions. 
However, the arguments would be stronger if the information 
was about specific audit techniques or methods which weren’t 
already public and revealing details about them would reduce 
their effectiveness in future, thereby prejudicing audit 
functions. 


Negative effect on the supply of information 


24. This is a further scenario where disclosure might be prejudicial 


to audit functions. Sometimes public authorities carrying out 
audits and inspections within the definition of s33 receive 
valuable information from others which helps them to carry out 
those functions. In our guidance Impact of disclosure on the 
voluntary supply of information, which mainly focusses on 
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section 31, we acknowledge the similarities with the section 33 
exemption. For instance, where information has been provided 
voluntarily to an auditor by a whistleblower, an authority might 
wish to argue that disclosure of the information would 
discourage co-operation with the auditor in the future, thus 
prejudicing the audit function. Please refer to that guidance for 
further details of the factors to consider. 


Example 


ICO decision notice FS50364933, concerning the government’s 
e-Borders programme, found that the Cabinet Office had 
dealt with the request in accordance with FOIA when it cited 
section 33. 

In order to reach his decision, the Commissioner analysed 
whether disclosure would result in prejudice to the authority’s 
audit function. This took the form of a three stage process: 
whether the authority had identified a prejudicial outcome 
inherent in the exemption; whether that prejudicial outcome 
would be insignificant; and the likelihood of the prejudice 
arising. He determined that disclosure would have had an 
impact on the voluntary supply of information and that, due to 
the need to make progress on the audit in a timely manner, 
this would have been likely to give rise to prejudice to the 
authority’s audit function. 


The public interest test 


25. Section 33 is a qualified exemption; therefore the public 
authority must apply the public interest test to the requested 
information. For more details, please refer to our guidance on 


the public interest test. 


Arguments in favour of maintenance of the exemption 


26. Inherent in the overall purpose of public audit is the auditors’ 
role in checking that public bodies are able to account for public 
funds allocated to them, and that their work delivers value for 
money. Factors against disclosing audit information therefore 
include the following requirements: 
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e ensuring that auditors can effectively carry out their 
duties 


e protecting the integrity of the audit. 


Arguments in favour of disclosure 


27. However those very factors are also relevant to and overlap 
with the factors in favour of disclosure. 


28. The work of auditors is aimed at improving the accountability of 
public bodies and enhancing transparency in relation to their 
work. In favour of disclosure are factors including: 


e furthering public understanding in decisions made by public 
bodies; 


e improving public participation in debate; 


e promoting accountability and transparency in relation to 
decision making; and 


e promoting accountability and transparency in the use of 
public funds by public bodies. 


Example 


In OGC v Information Commissioner (EA/2006/0068 & 0080, 
19 February 2009) the tribunal discussed the public interest in 


maintaining the exemption and in disclosure, agreeing with the 
Commissioner that considerations under sections 33 and 35 
were likely to be similar. 


In relation to section 33, the tribunal attached little weight to 
the public interest inherent in the exemption. 


The OGC had claimed that the information added “nothing” to 
the debate on the merits of identity cards; the Tribunal 
however dismissed this argument since the public interest lay 
in knowing how the project had been implemented, not just in 
the merits or otherwise: “there was a clear public interest in 
analysing the benefits of the ID card scheme, seeing how the 
scheme had evolved and how the Government has or may 
come to a decision as to how to deliver the scheme”. 
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The tribunal also rejected the argument that the information 
might be hard to understand, commenting that it had no 
difficulty in doing so. 


The tribunal considered the timing of the potential disclosure; 
the OGC had argued that untimely disclosure would threaten 
the Gateway Review process by discouraging interviewees and 
reviewers from being candid. It found that non-attribution of 
comments would protect interviewees and that publication of 
the reports would be an incentive to interviewees to participate 
in the system and be more candid: “reviewers would have a 
greater incentive to be candid and complete in the carrying out 
of their functions in the knowledge that their actions might at 
some stage be subject to public scrutiny. The Tribunal regards 
this as a very telling consideration”. 


The tribunal ordered the disclosure of the two Gateway Reports 
in question, subject to the redaction of names. 


Example 


In FS50364933 mentioned above, when applying the public 
interest test the Commissioner considered that factors in favour 
of disclosure included transparency and accountability 
arguments. However arguments weighing against these 
included the need to protect the flow of relevant information 
from interested parties to the auditors. It was important to 
preserve the integrity of the audit, especially since it was time- 
limited. 


The Commissioner’s decision was that the balance of the public 
interest in maintaining the s33 exemption outweighed the 
public interest in disclosure. 


The duty to confirm or deny 


29; 


Section 1(1)(a) of FOIA requires a public authority to inform 
the requester “whether it holds information of the description 
specified in the request”. This is known as the duty to confirm 
or deny. This duty applies even if the information itself is 
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30. 


exempt from disclosure, unless that duty is excluded. In the 
case of information on audit functions, section 33(3) removes 
the duty to confirm or deny: 


if, or to the extent that, compliance with section 1(1)(a) 
would, or would be likely to, prejudice the exercise of 
any of the authority’s audit functions referred to in 
subsection (1). 


For further details of the duty to confirm or deny, see the ICO’s 
guidance: When to refuse to confirm or deny information is held. 


Other considerations 


31. 


32. 


You might also want to consider whether other exemptions are 
relevant, such as section 34 (Parliamentary privilege), section 
40 (personal information), section 41 (information provided in 
confidence) and section 43 (commercial interests). 


This guidance relates only to FOIA. If the information is 
environmental it must be considered under the Environmental 
Information Regulations 2004 (the EIR). There is no direct 
equivalent in the EIR to the public audit exemption and public 
authorities will therefore need to consider whether any of the 
exceptions in regulations 12(4) or (5) apply. 


More information 


33. 


34. 


35. 


Additional guidance is available on our guidance pages if you 
need further information on the public interest test, other FOIA 
exemptions, or EIR exceptions. 


This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are 
often referred to the Information Commissioner than on those 
we rarely see. The guidance will be reviewed and considered 
from time to time in line with new decisions of the Information 
Commissioner, Tribunals and courts. 


It is a guide to our general recommended approach, although 


individual cases will always be decided on the basis of their 
particular circumstances. 
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36. If you need any more information about this or any other 
aspect of freedom of information, please contact us, or visit our 


website at www.ico.org.uk. 
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